cloud network security


When I first know about Tailscale, I didn’t “get” it. I read that it is like VPN but not quite the same as your traditional VPN, but I don’t know the details. But since there are a lot of rave reviews from HN users I got curious. After trying it out, I am immediately sold. I have now installed it on all my personal devices.

Tailscale is a revolutionary new way of connecting devices together. Once setup – and it’s very easy to set up – your devices behave just like they are on the same network. No complicated VPN to setup, or persistent connection issues, or remembering IP addresses to access your devices. It just works.

Tailscale is akin to VPN what Dropbox is to file synchronizing.

Tailscale offers a wide range of benefits for businesses and individuals alike. One of the key benefits of Tailscale is that it allows users to access their networks and devices without the need for traditional VPN software. This means that users can access their networks and devices from any device, including smartphones, tablets, and laptops, without the need for additional software or configuration. This makes it extremely convenient for users who need to access their networks and devices while on the go.

Another benefit of Tailscale is that it offers top-of-the-line security. Tailscale uses state-of-the-art encryption to ensure that all data transmitted over the network is secure and protected from cyber threats. This makes it ideal for businesses and organizations that handle sensitive data and need to ensure that it is protected at all times.

The best part is Tailscale is extremely easy to use. It has a simple and intuitive user interface that makes it easy for users of all skill levels to set up and use.

I highly recommend trying it out to just to see how it works. Tailscale is free for personal use.

programming security

NIST Retires SHA-1 Cryptographic Algorithm | NIST

NIST, the US standards body in charge of cybersecurity, is recommending phasing out the use of SHA-1 due to vulnerabilities in the algorithm and possibility of attacks by powerful machines. Modern browsers have already sunset support for SHA-1. However, older applications may still be using it as a form of checksum.

The venerable cryptographic hash function has vulnerabilities that make its further use inadvisable.

Source: NIST Retires SHA-1 Cryptographic Algorithm | NIST

ai cloud

Amazon Polly speaks Cantonese

By now, text to speech systems are quite common and widely in use. Tiktok has this feature added as part of their app some time ago. Amazon Polly – Amazon’s version of text-to-speech service – was launched in 2016 and supports quite a large number of languages.

Just this week, AWS announced the availability of a female Cantonese voice to Polly. Upon reading about this, I have to test it out. For the test, I took a sample text from YES 933 facebook page and fed it to Polly. I must say I’m very impressed with the results.

Of course, Amazon Polly is not the first or only Cantonese text-to-speech service out there, but it’s definitely one of the most natural sounding one I’ve heard. Looking forward for more languages to be support.

Footnote: there are some minor modifications to the text to achieve the desired result, eg. to get pauses in the right places, to say nine-three-three instead of nine hundred thirty three etc. But otherwise only default settings are used.


Image which displays its own MD5 hash

This is very impressive. Someone managed to create an image whose MD5 hash (also known as MD5 sum) is in the image. Why is it impressive? Well, for one, hashes are computed based on the contents of the input, and even making a one bit change creates wildly different hashes. Let me illustrate this with an example:

$ echo -n 1234 | md5sum
81dc9bdb52d04dc20036dbd8313ed055 *-

$ echo -n 1235 | md5sum
9996535e07258a7bbfd8b132435c5962 *-

1234 and 1235 differs by just 1 bit. In binary:

1234 is 00110001 00110010 00110011 00110100
1235 is 00110001 00110010 00110011 00110101

and yet the MD5 hash is totally different. Imagine if you’re trying to create a text document with this content:

The MD5 sum of this is: 12345678901234567890123456789012

Obviously the MD5 hash is not going to be 12345678901234567890123456789012.
It computes to b8aca742ffc52d6bea85fd87a92d3ede.

So you tweak the contents to this:

The MD5 sum of this is: b8aca742ffc52d6bea85fd87a92d3ede

Now the MD5 sum becomes 878da8ba44a3938fdce6da2191f221a1.

The minute you attempt to tweak the contents, the MD5 hash changes.

So it is possible to engineer a text such that the MD5 hash is contained in the text? The answer is probably yes. But you will have to test 2^128 combinations to find it.

Which brings us to the image. Creating an image like this is difficult, due to the encoding and checksums that a valid PNG image needs to have. Yes it’s not the first image-based hash quine (or file that show their own hash), but what makes this even more impressive is the deliberate choice of choosing 1337 to appear at the front and back of the MD5 sum.

Kudos to the author for this achievement.

The image in this post displays its own MD5 hash. You can download and hash it yourself, and it should still match – 1337e2ef42b9bee8de06a4d223a51337 I think this is the first PNG/MD5 hashquine.

Source: Retr0id

cloud internet

Comparison of AWS Compute Options in 2022

This is a non-exhaustive comparison of the popular AWS compute options. Hopefully it will help someone who’s also evaluating the various options for running your workload in AWS.

EC2 is the oldest and the most popular option as it is the easiest to start with. However you do have to manage a lot of things if you are choosing this option (OS, scaling, HA, etc). As a developer who may not be so familiar with cloud architecture, this can be daunting. Over the years, AWS has been making it easier to deploy code and make it scale. The latest compute product App Runner is a super simple way to write web applications in AWS. Though there are some who reported teething issues using it, I have no doubt those will be fixed in due time when it hits general availability.


cloud sysadmin

Granting AWS billing access to IAM (non-root account) users

By default, IAM users will not be allowed to access the Billing dashboard. This is true even if the user has AdministratorAccess permission. If you use AWS as a non-root/owner account user, but require access to billing and payment, here’s how you can do it.

Create billing IAM policies

  1. Go to IAM:
  2. Select Policies > Create policy
    1. Choose a service > Enter “Billing”
    2. Check All billing actions
  3. Review > name it “BillingFullAccess” > Create policy

Attach billing policy

You can attach billing policy to users or user groups. For simplicity, let’s assume we are applying it a user.

  1. Go to IAM:
  2. Select users > choose the user that you want to apply
  3. Select Add permissions > Attach existing policies directly
  4. Check BillingFullAccess
  5. Review > Add permission

Activating access to the AWS billing console

From AWS documentation,

By default, IAM users and roles within an AWS account can’t access the Billing console pages. This is true even if the IAM user or role has IAM policies that grant access to certain Billing features.

The last step is to enable this permission. To do so,

  1. Sign in as root/account owner
  2. Click on your username on the top right and select Account
  3. Scroll down to IAM User and Role Access to Billing Information
  4. Click Edit, check Activate IAM Access
  5. Update

And it’s done. You can now login as the IAM user and access the billing dashboard.

cloud security sysadmin

New for Amazon GuardDuty – Malware Detection for Amazon EBS Volumes | AWS News Blog

Once configured, AWS GuardDuty will now scan EBS volumes for malware and report its findings when it detects suspicious activities. If you haven’t enable it already, you should do so.

When you have GuardDuty Malware Protection enabled, a malware scan is initiated when GuardDuty detects that one of your EC2 instances or container workloads running on EC2 is doing something suspicious.


Security Certification Roadmap – Paul Jerimy Media

It’s probably impossible to get every security certification out there. But it’s still fun to see them being listed and classified neatly like this.

IT Security Certification Roadmap charting security implementation, architecture, management, analysis, offensive, and defensive operation certifications.

Source: Security Certification Roadmap – Paul Jerimy Media

cloud internet privacy

The Era of Borderless Data Is Ending – The New York Times

From data privacy and data residency to digital sovereignty, change is happening, and not necessarily in a good way. The wild west that characterize the Old Internet is being chipped off one block at a time. Some predicts this will lead to the end of general computation and further entrench incumbents, making it even more difficult for new players to break in.

Nations are accelerating efforts to control data produced within their perimeters, disrupting the flow of what has become a kind of digital currency.

Source: The Era of Borderless Data Is Ending – The New York Times


Imagen: Text-to-Image Diffusion Models

Text-to-image generation is now surprising good. Some predicts the end of stock photo business – why use a stock photo when you can generate any image you need just based on description?

Google develops competing model to DALL-E 2, which purportedly performs better than the latter and other models in a test with human raters.

Generated from text prompt “A robot couple fine dining with Eiffel Tower in the background”.

Source: Imagen: Text-to-Image Diffusion Models